Activities of "Anjaneyulu"

Thank you for prompt response . Will check and update you.

• ABP Framework version: v5
• UI Type: MVC
• • Database System: EF Core (SQL Server)
• Tiered (for MVC) or Auth Server Separated (for Angular): yes
• Exception message and full stack trace:
• Steps to reproduce the issue:

We have created a dotnet project with earlier versions of ABP framework on dotnet 3 and later upgraded the dotnet version to 5 and lepton theme with ABP framwork 5.

Now the issue is our client has raised a black box pointer regarding the datatables.net version of the jquery.

*** The below POC describes that Application is using vulnerable version of datatables.net v1.10.22 below mentioned is the cve id for it: jquery datatables.net v1.10.22 :- CVE-2020-28458,CVE-2021-2344 ***

I need to updagrade the jquery& datatable.net version with out disturbing any other things as the application in production. I need to make sure resolve the pointer in the best way possible. attaching here with the screenshots for your reference.

I do see the follwing in the yarn.lock file :

"@abp/datatables.net-bs4@~3.3.2": version "3.3.2" resolved "https://registry.yarnpkg.com/@abp/datatables.net-bs4/-/datatables.net-bs4-3.3.2.tgz#8f55957f2d9e1558ebef2e42e2661573d7d76447" integrity sha512-oERUHVPldaVL5z4CJX6cFkSBoa5IQUEYyyxGiV8zJ/mzZ7uiV2+hMrSP90R9J4625op9rU2+OJpDoZaj6wsULQ== dependencies: "@abp/datatables.net" "~3.3.2" datatables.net-bs4 "^1.10.21"

"@abp/datatables.net@~3.3.2": version "3.3.2" resolved "https://registry.yarnpkg.com/@abp/datatables.net/-/datatables.net-3.3.2.tgz#7a396dd06f4c7cddae534a59f9b21036b26d234a" integrity sha512-huB1A8aXDpS1CdE4t2NukZxTZnOuGy+8nRGlKVI3kMDD4tRveX5ITfgPEAY/CckcbSwjFP2zqbmFZiuqim7FaQ== dependencies: "@abp/jquery" "~3.3.2" datatables.net "^1.10.21"

Thanks & Appreciate your response ASAP.

Steps:

1. Run the demo server and login into application as host.
2. Create a tenant
3. Login into tenant page and add any openid client in the Openid applications
4. You can also check our sample ebanking in the test folder in repository
5. After adding an openid client in server, configure the client with the client,secret and default scopes.
6. Try logging in to the openid client application.
7. Try logout.
8. It is not logging out. If you open the url again it is navigating to the main page with out asking login credentials.

HI @maliming, we have created a basic abp project. @ https://github.com/rajasekhard2015/demo

Tried extending openid dict to tenant . Please check the commits to see what all changes we have made.

We were able to add client and do authentication. but we are having issue for logout.

Can you please help us. It very critical for our delivery.

• ABP Framework version: v6.0.1

• UI type: MVC

• DB provider: EF Core

• Tiered (MVC) or Identity Server Separated (Angular): yes

• Exception message and stack trace: AutoMapperConfigurationException: The following member on IdentityServer4.Models.ApiResource cannot be mapped:AllowedAccessTokenSigningAlgorithmsAdd a custom mapping expression, ignore, add a custom resolver, or modify the destination type IdentityServer4.Models.ApiResource.Context:Mapping to member AllowedAccessTokenSigningAlgorithms from Volo.Abp.IdentityServer.ApiResources.ApiResource to IdentityServer4.Models.ApiResourceException of type 'AutoMapper.AutoMapperConfigurationException' was thrown.

• Steps to reproduce the issue:"

• Upgrade abp framework from 5.2.0 to 6.0.1

• We are using identity server source code instead of packages.

Configure<AbpAntiForgeryOptions>(options => 
{ 
    options.AutoValidateIgnoredHttpMethods.Remove("GET"); //auto validate for GET requests 
}); 

After I've configured the AbpAntiForgeryOptions as above, I could not send a successful GET request to my endpoints unless I provide a RequestVerificationToken header.

But if there is an interceptor and passes a RequestVerificationToken on behalf of me, I can successfully make a GET request as follow. (And we do it on Swagger UI)

---

So can you try to navigate the URL of one of your GET requests on the browser? I am not sure but "burpsuite" might be intercepting the request and passing the RequestVerificationToken automatically (maybe you can check the header that it passed).

After adding this configuration we are not getting data for our Get request : -

Configure<AbpAntiForgeryOptions>(options => { options.AutoValidateIgnoredHttpMethods.Remove("GET"); //auto validate for GET requests });

But Adding this middleware , we are getting data but intercepting through burpsuite , removing request verification token and forwarding request is working fine.

public class SetRequestVerificationHeaderMiddleware { private readonly RequestDelegate _next; private readonly IAbpAntiForgeryManager _abpAntiForgeryManager;

public ValidateAntiForgeryTokenMiddleware(RequestDelegate next, IAbpAntiForgeryManager abpAntiForgeryManager)
{
    _next = next;
    _abpAntiForgeryManager = abpAntiForgeryManager;
}

public async Task Invoke(HttpContext context)
{
    if (HttpMethods.IsGet(context.Request.Method))
    {
       var antiForgeryToken = await _abpAntiForgeryManager.GenerateToken();
       context.Request.Headers["RequestVerificationToken"] = antiForgeryToken;
    }
    
    await _next(context);
}

}

//use middleware app.UseMiddleware<SetRequestVerificationHeaderMiddleware>();

Even Im not sure how burpsuite works.

Configure<AbpAntiForgeryOptions>(options => 
{ 
    options.AutoValidateIgnoredHttpMethods.Remove("GET"); //auto validate for GET requests 
}); 

After I've configured the AbpAntiForgeryOptions as above, I could not send a successful GET request to my endpoints unless I provide a RequestVerificationToken header.

But if there is an interceptor and passes a RequestVerificationToken on behalf of me, I can successfully make a GET request as follow. (And we do it on Swagger UI)

---

So can you try to navigate the URL of one of your GET requests on the browser? I am not sure but "burpsuite" might be intercepting the request and passing the RequestVerificationToken automatically (maybe you can check the header that it passed).

Thanks. I will check and Let you know

Hi @Anjaneyulu, you're not sending requests via Swagger right?

No. Actually we are intercepting the get request in burpsuite , removing the request verification token and forwarding the request to server. Should we consider burpsuite interpection as a swagger or postman request? I'm not sure.

Then you can create a middleware as below and get the generated cookie and pass it to the RequestVerificationToken header.

P.S. If your GET requests don't change the state (and it shouldn't in most cases), you don't need to add anti-forgery token validation, in my opinion.

public class SetRequestVerificationHeaderMiddleware 
{ 
    private readonly RequestDelegate _next; 
    private readonly IAbpAntiForgeryManager _abpAntiForgeryManager; 
 
    public ValidateAntiForgeryTokenMiddleware(RequestDelegate next, IAbpAntiForgeryManager abpAntiForgeryManager) 
    { 
        _next = next; 
        _abpAntiForgeryManager = abpAntiForgeryManager; 
    } 
 
    public async Task Invoke(HttpContext context) 
    { 
        if (HttpMethods.IsGet(context.Request.Method)) 
        { 
           var antiForgeryToken = await _abpAntiForgeryManager.GenerateToken(); 
           context.Request.Headers["RequestVerificationToken"] = antiForgeryToken; 
        } 
         
        await _next(context); 
    } 
} 
 
//use middleware 
app.UseMiddleware<SetRequestVerificationHeaderMiddleware>(); 
 

We have added this configuration, but when we remove the request verification token from requests, response is still perfect. Are we missing something ? Please guide.

Hi @Anjaneyulu, I think you don't need to create a manual Anti Forgery Token Middleware. Instead, you can define AbpAntiForgeryOptions to enable auto validation for GET requests.

Configure<AbpAntiForgeryOptions>(options => 
{ 
    //By default only POST requests auto validate anti forgery tokens. 
    //In other word "GET", "HEAD", "TRACE" and "OPTIONS" HTTP methods are ignored. 
     
    options.AutoValidateIgnoredHttpMethods.Remove("GET"); //auto validate for GET requests 
     
}); 
 

See CSRF Anti Forgery documentation for more information

Hi @EngincanV , I have configured as you said

Configure<AbpAntiForgeryOptions>(options => { //By default only POST requests auto validate anti forgery tokens. //In other word "GET", "HEAD", "TRACE" and "OPTIONS" HTTP methods are ignored.

options.AutoValidateIgnoredHttpMethods.Remove("GET"); //auto validate for GET requests });

Im not receving any data in get request. Do i need to add anything else ?